Depending on the security needed for a particular application I have been wondering why not just Email for authentication since its common for password recovery. More here: http://blog.headspin.com/?p=352
1. You always need access to email to get access to a website. This means that for whatever reason you don't have email access, you are locked out of all sites.
2. While it works from a security standpoint, you still add overhead to the users task. Users have to go between website and email and back to website just to log in.
3. slow connections might make the task even more cumbersome since you now add the delay of checking emails just in addition to logging into the website.
And yeah its a little more tedious if the site doesn't have a long session time.
In theory, you could just continue to click "Forgot password" every time you need to log in, indefinitely. Some sites that offer this sort of functionality, that's what I do.
What I hate is when the forgot password link FORCES you to change your password. If there's a forgot password link that lets me log in easily via email, then I see no reason to be forced to change my password.